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DETAILED ACTION 



Response to Amendment 

This office action is in response to amendment filed on November 27, 2006. Applicant 
currently amended 18, and cancelled Claim 19. Therefore, presently pending claims are 1-18. 



Response to Arguments 



Applicant's arguments with respect to claims 1-18 filed on November 27, 2006 have been 
considered but are moot in view of the new ground(s) of rejection. 

Applicant amended Claim 18, and cancelled Claim 19. Therefore, previous rejection 
under 35 U.S.C. 101 has been withdrawn. 



Double Patenting 

1. The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude 1 ' granted by a patent and to prevent possible 
harassment by multiple assignees. See In re Goodman, 1 1 F.3d 1046, 29 USPQ2d 2010 (Fed. 
Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 
F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, All F.2d 438, 164 USPQ 619 (CCPA 
1970);and, In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321(c) may be used to 
overcome an actual or provisional rejection based on a nonstatutory double patenting ground 
provided the conflicting application or patent is shown to be commonly owned with this 
application. See 37 CFR 1.130(b). 
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Effective January 1 5 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 
CFR 3.73(b). 

1. Claims 1-18 of the instant Application No. 09/491727 (hereafter '727) are provisionally 
rejected under the judicially created doctrine of obviousness-type double patenting as being 
unpatentable over claims 1-21 of copending Application No. 10/027714 (hereafter c 714). 
Although the conflicting claims are not identical, they are not patentably distinct from each other 
because in view of the obviousness type double patenting rationale enunciated in Georgia- 
Pacific Corp. v. United States Gypsum Co., 195 F.3d 1322, 1326, 52 USPQ2d 1590, 1593 
(Fed. Cir. 1999, the instant application's '727 above mentioned claims merely detecting 
presence of observer program on host devices in network computing environment by comparing 
memory content which is a obvious variation of scanning a host computer for observer program 
by comparing the memory content in a network environment as claimed in copending application 
'714. 

This is a provisional obviousness-type double patenting rejection because the conflicting 
claims have not in fact been patented. 
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Claim Rejections - 35 USC §103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

1. Claims 1-18 are rejected under 35 U.S.C. 103(a) as being unpatentable over Johnson et al 
(U. S. Patent 5,964,839) and further in view of Togawa (U. S. Patent 6,240,530). 

2. With respect to claim 1, Johnson teaches a system for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, the system 
including computer software fro running on the computer system (col.2 line 44 to col.31ine 66), 
the system comprising: 

observer data that includes data descriptive of an observer program, the observer program being 
programmed to observe a user's activities on the computer system by monitoring user input 
entered through a user input device and also operating to create log file from the observing of the 
observer program; and accessing instructions that access the observer data, generating 
instructions that generate results from the comparing, wherein the results generated indicate 
whether the observer program is present on the computer system; and outputting instructions that 
obtain the results and provide the results for a user (col. 12 line 51 to col. 14 line 15). 
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Although the system disclosed by Johnson shows all the features of the claimed 
limitation, but Johnson does not specifically disclose comparing instructions that compare the 
observer data with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing reading instructions that read memory of the 
computer system to obtain memory data, comparing instructions that compare the observer data 
with memory data read in from memory to determine whether the observer program is present on 
the computer system (col. 8 line 10 to col. 11 line 28, and col.19 line 16 to col.20 line 10). 
Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa' s method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
against attempt by unauthorized person to breach security of system (Togawa,col.5 line 7 to line 
38) 

3. Claim 2 is rejected as above in rejecting claim 1, wherein the reading instructions read 
the memory of the computer system by querying the operating system of the computer system 
for the tasks running and by examining task information provided by the operating system 
[col. 13 line 55 to line 65). 

4. Claim 3 is rejected as above in rejecting claim 1, wherein the outputting instructions 
provide the results to a user through a graphical user interface (col.8 line 21 to line 35). 
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5. Claim 4 is rejected as above in rejecting claim 1, wherein the reading instructions read 
the memory of the computer system by querying the file system of the computer system for the 
files located on storage media and by examining file information provided by the file system 
(Togawa: col. 19 line 10 to col. 20 line 65). 

6. Claim 5 is rejected as above in rejecting claim 1, wherein the reading instructions read 
the memory of the computer system by opening a file located on storage media and by 
examining contents of the file (Togawa: col. 19 line 10 to col. 20 line 65). 

7. Claim 6 is rejected as above in rejecting claim 1, wherein the observer data includes data 
descriptive of a plurality of observer programs and wherein the system compares the observer 
data with the memory data to determine whether any known observer program is present 
(Togawa: col. 19 line 10 to col.20 line 65). 

8. Claim 7 is rejected as above in rejecting claim 1, further comprising countermeasure 
instructions wherein the countermeasure instructions alter the operation of the observer program 
(Togawa: col. 19 line 10 to col.20 line 65). 

9. Claim 8 is rejected as above in rejecting claim 7, wherein the countermeasure instructions 
alter the operation of the observer program by altering observer program configuration data 
(Togawa: col. 19 line 10 to col.20 line 65). 

10. Claim 9 is rejected as above in rejecting claim 7, wherein the countermeasure instructions 
alter the operation of the observer program by altering a file on the computer system (Togawa: 
col.5 line 7 to line 39, col.l31ine 8 to line 56, and col. 19 line 10 to col.20 line 65). 

11. Claim 10 is rejected as above in rejecting claim 7, wherein the countermeasure 
instructions alter the operation of the observer program by altering reporting data generated by 
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the observer program (Togawa: col.5 line 7 to line 39, col.l31ine 8 to line 56, and col. 19 line 10 
to col.20 line 65). 

12. Claim 1 1 is rejected as above in rejecting claim 7, wherein the countermeasure 
instructions alter the operation of the observer program by replacing reporting data generated by 
the observer program (Togawa: col.5 line 7 to line 39, col.Dline 8 to line 56, and col. 19 line 10 
to col.20 line 65). 

13. Claim 12 is rejected as above in rejecting claim 7, wherein the countermeasure 
instructions alter the operation of the observer program by replacing a file of the observer 
program (Togawa: col.5 line 7 to line 39, col.Dline 8 to line 56, and col. 19 line 10 to col.20 line 
65). 

14. Claim 13 is rejected as above in rejecting claim 1, wherein the observer data includes 
data descriptive of observing activity typical of observing programs and wherein the system 
compares the observer data with the memory data to determine whether any known observer 
program is present (Johnson: (col. 12 line 51 to col. 14 line 15, and Togawa: col.5 line 7 to line 
39, col.l31ine 8 to line 56, and col. 19 line 10 to col.20 line 65). 

15. Claim 14 is rejected as above in rejecting claim 1, further comprising the observer data, 
wherein the observer data includes a list of files and modules that are part of the observer 
program software, and wherein the reading instructions read the memory of the computer system 
by querying the operating system of the computer system for the tasks running and by examining 
task information provided by the operating system, and wherein the reading instructions also 
read the memory of the computer system by querying the file system of the computer system for 
the files located on storage media and by examining file information provided by the file system, 
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and wherein the outputting instructions provide the results to a user through a graphical user 
interface (Johnson: (col. 12 line 51 to -col. 14 line 15, and Togawa: col. 5 line 7 to line 39, 
col.l31ine 8 to line 56, and col.19 line 10 to col.20 line 65). 

16. Claim 15 is rejected as above in rejecting claim 1, wherein the system is made available 
over a computer network through a web site (Johnson: Fig.l col.41ine 30 to col. 5 line 38). 

17. With respect to claim 16, Johnson teaches a system for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, the system 
including computer software fro running on the computer system (col.2 line 44 to col.31ine 66), 
the system, comprising: 

observer data that includes data descriptive of an observer program, the observer program being 
programmed to observe a user's activities on the computer system by monitoring user input 
entered through a user input device and also operating to create log file from the observing of the 
observer program; and means for accessing the observer data; means for generating results from 
the comparison, wherein the results generated indicate whether the observer program is present 
on the computer system; and means for outputting the results for a user (col. 12 line 51 to col. 14 
line 15). 

Although the system disclosed by Johnson shows all the features of the claimed 
limitation, but Johnson does not specifically disclose comparing instructions that compare the 
observer data with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
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relates to method and apparatus for providing means for reading memory of the computer system 
to obtain memory data, means for comparing the observer data with memory data to determine 
whether the observer program is present on the computer system (col. 8 line 10 to col. 1 1 line 28, 
and col. 19 line 16 to col.20 line 10). 

Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa* s method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
against attempt by unauthorized person to breach security of system (Togawa,col.5 line 7 to line 
38) 

18. With respect to claim 17, Johnson teaches a method for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, the system 
including computer software fro running on the computer system (col. 2 line 44 to col.31ine 66), 
the method comprising the steps of: 

accessing observer data, the observer data including data descriptive of an observer program, the 
observer program being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to create log file 
from the observing of the observer program; generating results from the reading and comparing, 
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wherein the results generated indicate whether the observer program is present on the computer 

system; and outputting the results for a user (col 12 line 51 to col. 14 line 15). 

Although the system disclosed by Johnson shows all the features of the claimed 
limitation, but Johnson does not specifically disclose comparing instructions that compare the 
observer data with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing reading memory of the computer system to obtain 
memory data; comparing the observer data with memory data read in from memory to determine 
whether the observer program is present on the computer system (col. 8 line 10 to col.l 1 line 28, 
and col. 19 line 16 to col.20 line 10). 

Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa' s method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
against attempt by unauthorized person to breach security of system (Togawa,col.5 line 7 to line 
38) 

19. With respect to claim 18, Johnson teaches a computer-readable medium containing 
instructions for detecting the presence of an observing program on a computer system, wherein 
the observing program is programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and to create data from the observing 
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on the computer system, wherein the instructions are executable to (col.2 line 44 to col.31ine 66) 
comprised of the steps of: 

access observer data, the observer data including data descriptive of an observer program, the 
observer program being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to create log file 
from the observing of the observer program; generate results from the reading and comparing, 
wherein the results generated indicate whether the observer program is present on the computer 
system; and output the results for a user (col. 12 line 51 to col. 14 line 15). 

Although the system disclosed by Johnson shows all the features of the claimed 
limitation, but Johnson does not specifically disclose comparing instructions that compare the 
observer data with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing; read memory of the computer system to obtain 
memory data; compare the observer data with memory data read in from memory to determine 
whether the observer program is present on the computer system;(col.8 line 10 to col.l 1 line 28, 
and col.19 line 16 to col. 20 line 10). 

Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa' s method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
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against attempt by unauthorized person to breach security of system (Togawa,col.5 line 7 to line 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Syed Zia whose telephone number is 571-272-3798. The 
examiner can normally be reached on 9:00 to 5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



38). 



Conclusion 




